Email Privacy Enforcement

ABSTRACT

A system comprises email message parsing circuitry, tracking code suspect analyzer circuitry, reporting circuitry, and message modification circuitry. The email message parsing circuitry is operable to, after reception of an email message via a SMTP connection and prior to the email message being made available in a mailbox of a recipient of the email message, scan the email message to extract a tracking code suspect. The tracking code suspect analyzer circuitry is operable to analyze the tracking code suspect to determine, based on one or more characteristics of the tracking code suspect, whether the tracking code suspect is tracking code. The reporting circuitry is operable to, after a determination that the tracking code suspect is tracking code, generate a report that indicates the presence of tracking code in the email message. The message modification circuitry is operable to replace the tracking code suspect in the email message with replacement content.

PRIORITY CLAIM

This application is a continuation of U.S. patent application Ser. No.15/285,797 filed on Oct. 6, 2016, which is hereby incorporated herein byreference.

BACKGROUND

Limitations and disadvantages of conventional approaches to email willbecome apparent to one of skill in the art, through comparison of suchapproaches with some aspects of the present method and system set forthin the remainder of this disclosure with reference to the drawings.

BRIEF SUMMARY

Methods and systems are provided for email privacy enforcement,substantially as illustrated by and/or described in connection with atleast one of the figures, as set forth more completely in the claims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIGS. 1A and 1B illustrates an example network comprising a systemconfigured to protect the privacy of email interactions.

FIG. 2 depicts an example implementation of the privacy enforcementcircuitry of FIG. 1B.

FIG. 3 illustrates a first example flow of an email message through thesystem of FIG. 1 during reception of the email message by the emailsystem of FIG. 1.

FIG. 4A is a flowchart illustrating an example process performed by theprivacy enforcement circuitry of FIG. 1.

FIG. 4B is a flowchart illustrating an example process performed by theprivacy enforcement circuitry of FIG. 1.

FIG. 5 illustrates an example processing of an email by the privacyenforcement circuitry of FIG. 1.

FIGS. 6 and 7 illustrate retrieval of an email stored in the on-premisesemail subsystem of FIG. 1 in accordance with an example implementation.

FIG. 8 illustrates the email system of FIG. 1 serving an analyticsdashboard to a web client.

FIG. 9 illustrates an example dashboard of the email system of FIG. 1.

FIGS. 10 and 11 illustrate use of a dynamic image inserted by theprivacy enforcement circuitry.

DETAILED DESCRIPTION

FIG. 1A illustrates an example network comprising a system configured toprotect the privacy of email interactions. Shown are an on-premisesemail subsystem 102 (which operates as the email server(s) for domainx.com), a plurality of email clients 120, a firewall 122, a plurality ofweb clients 128, a plurality of mail systems 130 (which operate as theemail servers for domains other than X.com), and remote email subsystem144. The firewall 122, some of the email clients 120, the web clients128, other domain email systems 130, and remote email subsystem 144 areinterconnected via a public network 124 (e.g., the Internet).

The firewall 122 comprises circuitry operable to monitor and controltraffic coming into and out of the local area network (LAN) 150.

Each email client 120 is, for example, a desktop, laptop, tablet, orphone configured to run email client software such as Microsoft Outlook,Mozilla Thunderbird, or the like. Some of the email clients 120 areconnected to the email subsystem 102 via connections contained withinLAN 150, and others are connected via public network 124 and firewall122. The email clients 120 may connect to the email subsystem 102 usinga protocol such as SMTP, MAPI, IMAP, EAS, EWS, and/or POP3.

Each web client 128 is, for example, a desktop, laptop, tablet, or phoneconfigured to run a web browser such as Google Chrome, Mozilla Firefox,or the like. A user of a web mail client 128 may access the emailsubsystem 102 by browsing to a webmail interface (e.g.,https://www.owa.x.com) in the web browser.

The email systems 130 handle email for domains other than x.com (e.g.,y.com). Each of the mail systems 130 may be substantially the same asthe mail system comprising subsystem(s) 102 and/or 144 (“email system102/104”) or may comprise one or more conventional email servers.

Various aspects of this disclosure are directed to an email systemoperable to process incoming and/or outgoing email messages inaccordance with a data privacy policy (and/or other email policies) putin place by an administrator of the email system. In various exampleimplementations, the email system 102/144 is implemented entirely in anon-premises email subsystem 102, entirely in a remote email subsystem144, or is distributed among the on-premises subsystem 102 and theremote email subsystem 144. An example implementation of the emailsystem 102/144 comprising one or both of email subsystem 102 and emailsubsystem 144 is described below with reference to FIG. 1B, to whichattention is now directed.

The email system 102/144 comprises hardware 116 that in turn comprisesprocessing circuitry 104 (e.g., one or more chipsets or systems-on-chipcomprising one or more CPUs, memory, one or more graphics processors,one or more I/O controllers, etc.), network interface circuitry 106(e.g., Ethernet, Wi-Fi, and/or the like) and storage circuitry 108(e.g., one or more hard disk drives, solid state drives, and/or thelike, and associated control/drive circuitry). The hardware 116 isconfigured by software and/or firmware 118 to realize special purposecircuitry for handling email as described in this disclosure. In anexample implementation, the special purpose circuitry comprisesconnection handler circuitry 110, privacy enforcement circuitry 112,background message processing circuitry 113, message storage handlingcircuitry 114, content caching circuitry 115, and analytics andreporting circuitry 117.

The connection handler circuitry 110 is operable to connect the emailsystem 102/144 to email clients 120, web clients 128, and other emailsystems 130 using HTTP/HTTPS, SMTP, MAPI, IMAP, EAS, EWS, POP3, and/orany other suitable protocol(s).

The privacy enforcement circuitry 112 is operable to analyze the contentof email messages coming into and/or going out of email system 102/144.The privacy enforcement circuitry 112 is operable to handle the emailmessages (e.g., redirect, drop, archive, etc.) based on the results ofthe analysis. Such handling may include, for example, modifying thecontent of the email messages (e.g., add text and/or HTML elements,remove text and/or HTML elements, change text formatting, and/or thelike) as desired or necessary based on a data privacy policy that is inplace. In an example implementation, the data privacy policy is ano-tracking policy applicable to emails meeting determined criteria(e.g., email messages to and/or from particular users. Email messageshaving particular content in their headers, body, and/or attachments,and/or the like), and the privacy enforcement circuitry 112 performs theprocess(es) of FIG. 4A and/or FIG. 4B for each received email to whichthe no-tracking policy is applicable. An example implementation of theprivacy enforcement circuitry is shown in FIG. 2.

The background message processing circuitry 113 is operable to scan anemail message and/or external content associated with email message inparallel with the email message being processed by privacy enforcementcircuitry 112 and message storage handling circuitry 114. In thismanner, background message processing circuitry 113 may continue toanalyze a copy of an email message and/or external content associatedwith the email message after the email message has been placed in itsrecipient(s) inbox(es). An example operation of the background messageprocessing circuitry 113 is described below with reference to FIGS. 10and 11.

The message storage handling circuitry 114 is operable to store emailmessages and metadata pertaining to the email messages to storagecircuitry 108. The message storage handling circuitry 114 is operable toretrieve email messages and metadata pertaining to the email messagesfrom storage circuitry 108.

The content caching circuitry 115 is operable to store and serve contentembedded in, linked to by, and/or attached to email messages sent and/orreceived by the email system 102/144. The content may be cached at alocation identified by a unique uniform resource locator (URL)accessible via one or more networking protocols (e.g., FTP, HTTP/HTTPS,RDMA, etc.). The content may be cached at a location identified by aunique file path and file name and accessible via one or more localmemory access protocols (e.g., POSIX commands of a local operatingsystem). In an example implementation, the content caching circuitry 115retrieves content from a first URL (e.g., a URL extracted from anincoming and/or outgoing email message by the privacy enforcementcircuitry 112), stores the content in storage circuitry 108, and makesthe stored content accessible via a second URL (e.g., a URL generated bythe privacy enforcement circuitry 112).

The analytics and reporting circuitry 117 is operable collect, analyze,and generate data and/or metadata extracted from, and/or generated basedon, email messages received and/or sent by the email system 102/144.

FIG. 2 depicts an example implementation of the privacy enforcementcircuitry of FIG. 1B. The example implementation comprises trackingsuspect analyzer circuitry 202, email message parsing circuitry 204,content cache interface circuitry 206, analytics and reporting interfacecircuitry 208, and message modification circuitry 210.

The email message parsing circuitry 204 is operable to scan emailmessage contents (SMTP envelope, message headers, message body, andattachments) for tracking code suspects (e.g., raw binary and/or encodedcontent containing predefined strings and/or matching predefined regularexpressions), and, upon finding a tracking code suspect, pass thetracking code suspects to the tracking suspect analyzer circuitry 202.

The tracking suspect analyzer circuitry 202 is operable to apply atracking code identification algorithm to the tracking code suspectsreceived from the email message parsing circuitry 204 to determine, foreach suspect, whether it is in-fact a tracking code. The trackingsuspect analyzer circuitry 202 may also be operable to characterizeidentified tracking code. Such characteristics may include, for example:a vendor or organization associated with particular tracking code;amount and/or type of information revealed by the tracking code; risklevel associated with the tracking code, and/or the like.

In an example implementation, tracking code suspects may include <img>HTML elements, and the tracking suspect analyzer circuitry 202determines whether a suspect is in-fact tracking code based oncharacteristics of the <img> element. Such characteristics may include,for example, one or more of: the size of the <img>element (e.g., <img>elements with size below some threshold number of pixels may be morelikely to be identified as tracking code); transparency of the <img>element (e.g., <img> elements having a transparency attribute that isabove a determined threshold may be more likely to be identified astracking code); color(s) of the <img> element (e.g., <img> elements thatare the same as or similar to a background color may be more likely tobe flagged as tracking code); randomness of a URL of the <img> element(e.g., <img> elements having URLs with long strings of hexadecimalcharacters not having dictionary entries may be more likely to beidentified as tracking code); length of a URL of the <img> element(e.g., <img> elements having very long URLs may be more likely to beidentified as tracking code); presence of particular word(s) or regularexpressions in a URL of the <img> element; any aliases or IP address(es)associated with a URL of the <img> element in a DNS records (e.g., thetracking suspect analyzer circuitry 202 may be operable to perform DNSlookups); a URL to which a URL of the <img> element redirects (e.g., thetracking suspect analyzer circuitry 202 may be operable run a sandboxedweb browser via which it attempts to visit the URL and follows anyredirects); location of the <img> element within the message body (e.g.,<img> elements after the signature of an email message may be morelikely to be identified as tracking code); whether and how many times anidentical or similar <img> element has been detected (e.g., the same<img> element appearing many times within the same email message or aparticular group of email messages may be more likely to be identifiedas tracking code); and/or based on an image file associated with (e.g.,via URL or file path) the <img> element (e.g., previous images havingthe same file signature were associated with identified tracking code,previous images with the same binary content were associated withidentified tracking code, and/or the visible content of the image fileas determined by a “machine vision” or pattern recognition algorithmperformed on the image by the tracking suspect analyzer circuitry 202).

In an example implementation, tracking code suspects may include <a>HTML elements, and the tracking suspect analyzer circuitry 202 maydetermine whether a suspect is in-fact tracking code based oncharacteristics of the <a> element. Such characteristics may, forexample, include one or more of: randomness of a URL of the <a> element(e.g., <a> elements having URLs with long strings of hexadecimalcharacters not having dictionary entries may be more likely to beidentified as tracking code); length of a URL of the <a> element (e.g.,<a> elements having very long URLs may be more likely to be identifiedas tracking code); presence of particular word(s) or regular expressionsin a URL of the <a> element; any aliases or IP address(es) associatedwith a URL of the <a> element in a DNS records; and/or a URL to which aURL of the <a> element redirects (e.g., the tracking suspect analyzercircuitry 202 may be operable run a sandboxed web browser via which itattempts to visit the URL).

In an example implementation, tracking code suspects may include any<script>HTML elements, and the tracking suspect analyzer circuitry 202may determine whether a suspect is in-fact tracking code based oncharacteristics of the <script> element. Such characteristics mayinclude one or more of: randomness of a URL of the <script> element(e.g., <script> elements having URLs with long strings of hexadecimalcharacters may be more likely to be identified as tracking code); lengthof a URL of the <script> element (e.g., <script> elements having verylong URLs may be more likely to be identified as tracking code);presence of particular word(s) or regular expressions in a URL of the<script> element; any aliases or IP address(es) associated with a URL ofthe <script> element in a DNS records; and/or a URL to which a URL ofthe <script> element redirects (e.g., the tracking suspect analyzercircuitry 202 may be operable run a sandboxed web browser via which itattempts to visit the URL).

In an example implementation, tracking code suspects may include <link>HTML elements, and the tracking suspect analyzer circuitry 202 maydetermine whether a suspect is in-fact tracking code based oncharacteristics of the <link> element. Such characteristics may includeone or more of: randomness of a URL of the <link> element (e.g., <link>elements having URLs with long strings of hexadecimal characters may bemore likely to be identified as tracking code); length of a URL of the<link> element (e.g., <a> elements having very long URLs may be morelikely to be identified as tracking code); presence of particularword(s) or regular expressions in a URL of the <link> element; anyaliases or IP address(es) associated with a URL of the <link> element ina DNS records; and/or a URL to which a URL of the <link> elementredirects (e.g., the tracking suspect analyzer circuitry 202 may beoperable run a sandboxed web browser via which it attempts to visit theURL).

The content cache interface circuitry 206 is operable to: (1) receive,from the tracking suspect analyzer circuitry 202, a first URL pointingto a location at which content (e.g., images, videos, etc.) is stored,and a second URL via which the content is to be accessible when cachedin the email system 102/144; and (2) provide the first URL, and thesecond URL to the content caching circuitry 115 for caching of thecontent.

The analytics and reporting interface circuitry 208 is operable toconvey data and metadata from the email message parsing circuitry 204and/or the suspect analyzer circuitry 202 to the analytics and reportingcircuitry 117. Such data and/or metadata may include, for example:number of email messages processed by email message parsing circuitry204; number of suspects found by email message parsing circuitry 204;number of tracking code suspects identified as tracking code by trackingsuspect analyzer circuitry 202; categorizations/characteristics oftracking code identified by tracking suspect analyzer circuitry 202;and/or the like.

The message modification circuitry 210 is operable to modify headers,message bodies, and/or attachments of email messages processed by theprivacy enforcement circuitry 112. The modification of an email messageheader may comprise, for example, adding a header, removing a header,modifying a header. The modification of an email message body maycomprise, for example, adding text, adding an HTML element (e.g., an<img> HTML element having a URL that points to a location in the emailsystem 102/144), modifying text, modifying an HTML element, removingtext, and/or removing an HTML element. The modification of an emailmessage attachment may comprise, for example, adding text, adding anHTML element, modifying text, modifying an HTML element, removing text,and/or removing an HTML element.

FIG. 3 illustrates a first example flow of an email message through thesystem of FIG. 1 during reception of the email message by email systemof FIG. 1. Arrow 310 represents propagation of an email message 306 thatis (1) generated in a mail user agent (MUA) of email system 130; (2)communicated to a mail transfer agent (MTA) of email system 130 (e.g.,via SMTP); (3) communicated to email system 102/144 (e.g., via a SMTPconnection to connection handler circuitry 110); (4) processed viaprivacy enforcement circuitry 112; and (5) stored by message storagehandling circuitry 114 at which point the email message 306 is availableto (and, in some instances, may be pushed to) its recipient(s)'mailbox(es). Arrow 312 illustrates data and/or metadata being passed toanalytics and reporting circuitry 117. Arrow 314 illustrates data and/ormetadata being passed to content caching circuitry 115.

FIG. 4A is a flowchart illustrating an example process performed by theprivacy enforcement circuitry of FIG. 1. The process is described withreference to elements shown in FIGS. 2 and 3. The process begins withblock 402 which takes place after the email message 306 has beenreceived by connection handler circuitry 110 via SMTP and has beenpassed to privacy enforcement circuitry 112, but before the emailmessage 306 is made available in the inboxes of its x.com recipient(s).

In block 404, the privacy enforcement circuitry 112 begins scanning theemail message 306.

In block 405, the privacy enforcement circuitry 112 determines whetherthe sender of the email has previously been whitelisted (e.g., via theinterface described below with reference to FIG. 9). If the sender hasbeen whitelisted, the process advances to 420. If the sender has notbeen whitelisted, the process advances to block 406.

In block 406, each time tracking code is detected during the scan of theemail message then the process advances to block 408.

In block 408, the identified tracking code is logged. This may comprise,for example, passing the tracking code and/or characteristics of thetracking code to analytics and reporting circuitry 117 where it is addedto a database. In an example implementation, the privacy enforcementcircuitry 112 may flag the email message 306 as having been tracked bythe sender (e.g., add the text “tracked” to the subject line and/ormessage body).

In block 409, the privacy enforcement circuitry 112 determines whetherthe tracking code has previously been whitelisted (e.g., whitelisted viathe interface described below with reference to FIG. 9). If the trackingcode has been whitelisted, the process returns to block 406. If thetracking code has not been whitelisted, then the process advances toblock 410.

In block 410, if the tracking code identified in block 406 is notassociated with external content, then the process advances to block 412in which the tracking code is removed from the email. After block 410,the process returns to block 406 and the scanning continues looking formore tracking code in the email message.

Returning to block 410, if the tracking code identified in block 406 isassociated with external content (e.g., a tracked <img>, <a>, <scripts>,or <link> element having a URL pointing to an external content), thenthe process advances to block 414.

In block 414, the message modification circuitry 210 replaces thetracking code detected in block 406 with an untracked reference to theexternal content. For example, the tracking code may comprise an <img>element with a first URL, and the message modification circuitry 210 mayreplace the first URL with a second URL. The second URL may point to acopy of the external content which has been cached by content cachingcircuitry 115.

For example, referring briefly to FIG. 5, called out as 510 is emailmessage 306 upon arriving at the privacy enforcement circuitry 112.Called out as 520 is the email message 306 after processing by theprivacy enforcement circuitry 112. The email message 306 comprises SMTPenvelope 502, message headers 504, and message body 506. The messagebody 506 comprises an <img> element having an original URL of“URL/to/image” and an <a> element having an original URL of“URL/to/anchor.” After processing by the privacy enforcement circuitry112, the original URL of the <img> element has been replaced withreplacement URL “secure/URL/1.” The replacement URL may point to acached copy of the image which was pointed to by the original URL.Similarly, after processing by the privacy enforcement circuitry 112,the original URL of the <a>element has been replaced with replacementURL “secure/URL/2.” The replacement URL may point to the ultimatedestination (after any redirects, etc.) of the original URL.

In an example implementation, a replacement URL inserted by messagemodification circuitry 210 may comprise the original URL appended to orconcatenated with a URL that points to a location under common controlwith the email system 102/144. The original URL may be appended as aquery string, as one or more path element (path elements are separatedby forward slashes), or as a combination of a path element(s) and querystring. To illustrate, assume an original URL of www.y.com/image12345,then a corresponding replacement URL may be, for example:www.x.com/y/com/image12345 or www.x.com?y.com/image12345. In an exampleimplementation, the replacement URL may comprise an API key assigned tox.com (the domain associated with email system 102/144). For example,assuming an API key of “1811WN” the replacement URL may bewww.x.com/y/com/image12345/1811WN or www.x.com?y.com/image12345/1811WN.In an example implementation, a portion of the replacement URL may behashed or encoded using a key uniquely associated with x.com (the domainassociated with email system 102/144). For example, first the originalURL and an API key may be appended to a URL controlled by the owners ofx.com (e.g., www.x.com/y/com/image12345/1811WN orwww.x.com?y.com/image12345/1811WN), and then a portion of the URL may behashed or encrypted (e.g., www.x.com/y/com/image12345/1811WN becomeswww.x.com/4eYTRDhhy432%A3, or www.x.com?y. com/image12345/1811WN becomeswww.x.com?7DgeEF3$#$%d8y).

Returning to FIG. 4A, in block 416, it is determined whether thetracking code is already cached in the content caching circuitry 115 oris known to be unwanted or unneeded. Whether content is unwanted orunneeded may be determined based on one or more factors such as, forexample: its transparency, its size (in pixels or bytes), its ALT text,whether the file name is on a black list, whether the URL at which thecontent is hosted (or any portion of the URL, such as domain) is on ablack list, aliases or IP addresses associated with the URL at which thecontent is hosted, and/or the like. If the content is unwanted orunneeded, the process returns to block 406 and the scanning continueslooking for more tracking code in the email message. If the content isnot already cached and is not known to be unwanted or unneeded, then theprocess advances to block 418.

In block 418, the privacy enforcement circuitry 112 issues a request tothe content caching circuitry 115 for the content caching circuitry 115to download the external content and cache it. The privacy enforcementcircuitry 112 may provide a first URL from which to retrieve theexternal content, and a second URL via which the cached content can beaccessed. After block 418, the process returns to block 406 and thescanning continues looking for more tracking code in the email message.In an example implementation in which the content cache is in remoteemail subsystem 144 and the privacy enforcement circuitry 112 is inlocal email subsystem 102, the content cache interface circuitry 206 mayqueue up a plurality of URLs corresponding to content to be cached. Theplurality of queued URLs may then be sent to the content cachingcircuitry 115 in a single request.

Returning to block 406, if no more tracking code is detected in theemail message, then the process advances to block 420.

In block 420, the message, after having all tracking code removed orreplaced, is passed to message storage handling circuitry 114, at whichpoint it becomes available in its x.com recipient(s)' mailbox(es).

In block 422, data and/or metadata is passed to the analytics andreporting circuitry 117. Such data may include, for example, headers ofthe email message 306 and content and/or characteristics of trackingcode detected in the email message 306 (e.g., URLs and/or HTML elementsof the tracking code).

FIG. 4B is substantially similar to FIG. 4A except that all trackingcode suspects (and not just confirmed tracking code) are either removedor replaced. In this manner, even if a tracking code suspect isincorrectly identified as not being tracking code, any external contentassociated with that tracking code suspect will nevertheless be cachedby the content caching circuitry 115 before the email message becomesavailable in the recipient(s) inbox(es), thus preventing the sender ofthe email from knowing when and where the x.com recipient(s) read andforward the email message.

Removing tracking code and/or tracking code suspects from email message306 before the email message reaches the inbox(es) of its intended x.comrecipient(s) (the x.com RCPT TO recipient(s) as set by the sender'sMUA), as done in the processes of FIGS. 4A and 4B, ensures that therecipient(s) privacy will be protected regardless of the email client(s)120 or web client(s) 128 from which the recipient(s) check theiremail—all without the recipient(s) having to install or configureanything on their email client(s) 120 or web client(s) 128.

FIGS. 6 and 7 illustrate retrieval of an email stored in the on-premisesemail subsystem of FIG. 1 in accordance with an example implementation.The process in FIG. 6 begins with block 602 in which an email client 120sends a request, via connection handler circuitry 110, for the emailmessage 306 (which was processed by privacy enforcement circuitry 112per FIGS. 3 and 4) from message storage handler 114.

In block 604, email message 306 is passed, via connection handlercircuitry 110, to the email client 120.

In block 606, the email client 120 issues a command (e.g., an HTTP GETcommand) to fetch the image pointed to by the replacement URL.

In block 608, the content caching circuitry 115 receives the requestfrom the email client 120, retrieves the image from storage 108, andsends the content to the email client (e.g., in an HTTP response).

In block 610, the email client 120 receives the image and presents it inthe body of the email message 306. Because content caching circuitry 115(and not email client 120) retrieved the image from the original URL,and because any subsequent requests for the image (whether by the sameemail client 120 or a different email client 120) will be served bycontent caching circuitry 115, the host of the original URL (and thusthe sender of the email message 306) does not see: the type of device onwhich email client 120 is running, the location of the email client 120,the time that the email client 120 read the email message 306, or howmany times email client 120 opened the email message 306.

In some instances, the content caching circuitry 115 may not yet havehad a chance to retrieve and cache the image. In such instances, thecontent caching circuitry 115 may retrieve the image from the locationpointed to by the original URL (which may be included in the HTTP GETcommand as, for example, a query string of the requested URL), cache thecontent at a location pointed to by the replacement URL, then send theresponse with the image to the email client 120.

In FIG. 7, arrow 702 represents the request sent from client 120 tostorage handler 114. Arrow 704 represents the email message 306 beingconveyed from storage handler 114 to email client 120.

FIG. 8 illustrates the email system of FIG. 1 serving an analyticsdashboard to a web client. The web client 128 issues a request (e.g., aHTTP POST request) 802 which is received (via connection handlercircuitry 110) by analytics and reporting circuitry 142. The analyticsand reporting circuitry 142 responds with content (HTML, javascript,CSS, etc.) that, when rendered in the web client 128, results in adashboard such as the one described below with reference to FIG. 9.

FIG. 9 illustrates an example dashboard of the email system of FIG. 1.Shown is a web client 128 displaying a browser window 904 in which isrendered a dashboard comprising interface elements that provideinformation about processing that has been completed by the email system102/144 and interface elements via which a user can configure behaviorof the email system 102/144. In the example shown, the interfaceelements are arranged into a table in which each row corresponds to anemail message in which privacy enforcement circuitry 112 detectedtracking code, and each column is as described below.

The cell in each row of column 906 holds the receipt date of the emailmessage corresponding to the row. The email system 102/144 may haveextracted the receipt date from the SMTP envelope and/or headers of theemail message.

The cell in each row of column 908 holds the sender of the email messagecorresponding to the row. The email system 102/144 may have extractedthe sender information from the SMTP envelope and/or headers of theemail message.

The cell in each row of column 910 holds the subject line of the emailmessage corresponding to the row. The email system 102/144 may haveextracted the subject line from the headers of the email message.

In other embodiments, other columns similar to 906, 908, and 910 may bepresent and may hold other information extracted from the SMTP envelope,email message headers, email message body, and/or email messageattachments.

The cell in each row of column 912 contains an interface element (e.g.,a checkbox) that enables a user of the dashboard to add the sender ofthe email message to a whitelist. For example, checking the box incolumn 912 and row 918 may prevent the privacy enforcement circuitry 112from removing or replacing tracking code in future emails from F@Z.com.In another example implementation, the dashboard may provide interfaceelements for whitelisting by domain (e.g., not replacing or removingtracking code from any sender with an @Z.com email address).

In another example implementation, the dashboard may comprise another ordifferent table in which each row corresponds to an instance ofidentified tracking code. Such a table may show allow whitelisting orblacklisting particular tracking code or class/group of tracking code(e.g., whitelisting or blacklisting by domain, subdomain, and/or pathelements).

The cell in each row of column 916 indicates a characterization of thecorresponding email message. In the example shown, the characterizationis a categorization of tracking code detected in the email message,where the categories are: individually targeted tracking code,behavioral marketing tracking code, and bulk marketing tracking code.This characterization may be determined based on, for example, thefeatures provided by the tool which generated the tracking code (e.g.,whether the tool provides information on location of the recipient atthe time of open). In another example implementation, thecharacterization may be a risk level of the email message determinedbased on, for example, the sender (or just the sender's domain), thecategory of tracking code, and/or content of the message headers and/orbody.

FIGS. 10 and 11 illustrate use of a dynamic image inserted by theprivacy enforcement circuitry. Referring to FIG. 10, called out as 1010is email message 306 upon arriving at the privacy enforcement circuitry112. Called out as 1020 is email message 306 after being processed byprivacy enforcement circuitry 112. The email message 306 comprises SMTPenvelope 1002, email message headers 1004, and email message body 1006.In FIG. 10, the privacy enforcement circuitry 112 inserts, into body1006, an <img> element referencing a URL that is under the control ofemail system 102/144. In the example, the URL is“www.x.com/status_[uniqueID].png,” where “[uniqueID]” represents someunique identifier associated with the email message 306.

Now referring to FIG. 11, in block 1102, privacy enforcement circuitry112 inserts an <img> element having a unique URL into email message 306.

In block 1104, the privacy enforcement circuitry 112 informs the contentcaching circuitry 115 of the inserted image and the unique URL. Thecontent caching circuitry 115 associates the unique URL with analready-cached first image.

In block 1106, the process monitors for a change in status of the emailmessage 306.

In block 1108, in response to a change in status of the email message306, the unique URL is associated with an already-cached second imageinstead of the first image.

Through use of an <img> element in the body of the email, the status ofthe email message 306 will be seen by the user regardless of which emailclient 120 she happens to open the email on—there is no reliance on aparticular browser or plugin, for example. In serving the first image orsecond image, the content caching circuitry 115 may indicate to theemail client 120 that the image is not to be cached such that the emailclient 120 will fetch the latest image associated with the unique URLeach time the email message 306 is opened.

In an example implementation, the change in status of the email message306 the email message 306 either being flagged as a phishing attempt ornot a phishing attempt upon the completion of a phishing analysis by thebackground processing circuitry 113. That is, the phishing analysis maytake an amount of time that is longer than it is desired to delaydelivery of the email message to the x.com recipient(s)' inbox(es).Accordingly, the email message 306 may be conveyed to background messageprocessing circuitry 113 and to the message storage handling circuitry114 in parallel. The first image may indicate through imagery (e.g.,caution sign with caption “under review”) that the scan is incomplete.The second image may indicate that the email is not a phishing attempt(e.g., the second image may be a green check mark) or may indicate thatthe email is likely a phishing attempt (e.g., a red x with the caption“phishing attempt”). In this manner, if the user opens the email message306 and sees the first image, she knows to wait for the analysis tocomplete before interacting with the email. If the user opens the emailmessage 306 and sees the second image indicating that the email is not aphishing attempt, she knows she that interacting with the email is lowrisk. If the user opens the email if the user opens the email message306 and sees the second image indicating that the email is a phishingattempt, she knows to delete it and/or report it.

In accordance with an example implementation of this disclosure, asystem comprises email message parsing circuitry (e.g., 204), trackingcode suspect analyzer circuitry (e.g., 202), and message modificationcircuitry (e.g., 210). The email message parsing circuitry is operableto, after reception of an email message via a SMTP connection (e.g., viaconnection handler circuitry 110) and prior to the email message beingmade available in an inbox of a recipient of the email message (e.g.,the recipient indicated in the RCPT TO command of the SMTP exchange),scan the email message to extract a tracking code suspect. The trackingcode suspect analyzer circuitry is operable to analyze the tracking codesuspect to determine, based on one or more characteristics of thetracking code suspect, whether the tracking code suspect is trackingcode and, upon a determination that the tracking code suspect istracking code, notify the message modification circuitry. The messagemodification circuitry is operable to replace the tracking code suspectin the email message with replacement content. The one or morecharacteristics of the tracking code suspect may comprise a transparencyattribute and/or size attribute of an image associated with the trackingcode suspect. The one or more characteristics of the tracking codesuspect may comprise a uniform resource locator (URL) of the trackingcode suspect. The one or more characteristics of the tracking codesuspect may comprise a particular domain or subdomain in a uniformresource locator (URL) of the tracking code suspect. The one or morecharacteristics of the tracking code suspect may comprise a particularquery string in a uniform resource locator (URL) of the tracking codesuspect. The one or more characteristics of the tracking code suspectmay comprise a particular path element or combination of path elementsin a uniform resource locator (URL) of the tracking code suspect. Theone or more characteristics of the tracking code suspect may comprise adomain or Internet Protocol (IP) corresponding to a uniform resourcelocator (URL) of the tracking code suspect. The one or morecharacteristics of the tracking code suspect may comprise a length, innumber of alphanumeric characters, of the tracking code suspect. The oneor more characteristics of the tracking code suspect may comprisecharacteristics of visible content of an image associated with thetracking code suspect. The characteristics of the visible content of theimage may comprise color variation among pixels of the image. The one ormore characteristics of the tracking code suspect may comprise presenceof a particular substring in a uniform resource locator (URL) of thetracking code suspect. The one or more characteristics of the trackingcode suspect may comprise a uniform resource locator (URL) of thetracking code suspect being a match for a particular regular expression.The tracking code suspect may comprise a first uniform resource locator(URL). The replacement content may comprise a second URL. The second URLmay comprise the first URL as a query string. The second URL maycomprise the first URL as one or more path elements. The system maycomprise content cache interface circuitry (e.g., 206) operable to sendthe second URL to content caching circuitry. The system may comprisecontent caching circuitry (e.g., 115), and the content caching circuitrymay be operable to fetch content from the first URL and store thecontent at a location pointed to by the second URL. 19. The system maycomprise reporting circuitry. The tracking code suspect analyzercircuitry may be operable to determine which one of a plurality ofcategories (e.g., individually targeted, behavioral marketing, or bulkmarketing; or “high risk, medium risk, or low risk”) to assign toidentified tracking code based on a domain or IP address associated withthe identified tracking code, and assign the one of the plurality ofcategories to the identified tracking code. The system may compriseanalytics and reporting circuitry (e.g., 117) is operable to generate areport (e.g., dashboard of FIG. 9) that presents the assigned one of theplurality of the categories for the identified tracking code. The systemmay comprise interface circuitry (e.g., part of analytics and reportingcircuitry 117) operable to generate an interface via which a user canwhitelist a sender of the email message such that the messagemodification will not remove tracking code in future emails from thesender.

As utilized herein the terms “circuits” and “circuitry” refer tophysical electronic components (i.e. hardware) and any software and/orfirmware (“code”) which may configure the hardware, be executed by thehardware, and or otherwise be associated with the hardware. As usedherein, for example, a particular processor and memory may comprise afirst “circuit” when executing a first one or more lines of code and maycomprise a second “circuit” when executing a second one or more lines ofcode. As utilized herein, “and/or” means any one or more of the items inthe list joined by “and/or”. As an example, “x and/or y” means anyelement of the three-element set {(x), (y), (x, y)}. In other words, “xand/or y” means “one or both of x and y”. As another example, “x, y,and/or z” means any element of the seven-element set {(x), (y), (z), (x,y), (x, z), (y, z), (x, y, z)}. In other words, “x, y and/or z” means“one or more of x, y and z”. As utilized herein, the term “exemplary”means serving as a non-limiting example, instance, or illustration. Asutilized herein, the terms “e.g.,” and “for example” set off lists ofone or more non-limiting examples, instances, or illustrations. Asutilized herein, circuitry is “operable” to perform a function wheneverthe circuitry comprises the necessary hardware and code (if any isnecessary) to perform the function, regardless of whether performance ofthe function is disabled or not enabled (e.g., by a user-configurablesetting, factory trim, etc.).

Some implementations may comprise a non-transitory machine-readable(e.g., computer readable) medium (e.g., FLASH drive, optical disk,magnetic storage disk, or the like) having stored thereon one or morelines of code executable by a machine, thereby causing the machine toperform processes as described herein. The machine-readable medium maybe accessible via a network (e.g., the Internet) such that when the codeis downloaded and installed on local machines, the local machines areconfigured into a system as described in this disclosure, and when thecode is executed by such system, the system performs processes describedin this disclosure.

While the present method and/or system has been described with referenceto certain implementations, it will be understood by those skilled inthe art that various changes may be made and equivalents may besubstituted without departing from the scope of the present methodand/or system. In addition, many modifications (e.g., re-ordering offlowchart blocks) may be made to adapt a particular situation ormaterial to the teachings of the present disclosure without departingfrom its scope. Therefore, it is intended that the present method and/orsystem not be limited to the particular implementations disclosed, butthat the present method and/or system will include all implementationsfalling within the scope of the appended claims.

What is claimed is:
 1. A system comprising: email message parsingcircuitry, tracking code suspect analyzer circuitry, reportingcircuitry, and message modification circuitry, wherein: the emailmessage parsing circuitry is operable to: after reception of an emailmessage via a simple mail transfer protocol (SMTP) connection and priorto the email message being made available in a mailbox of a recipient ofthe email message, scan the email message to extract a tracking codesuspect; the tracking code suspect analyzer circuitry is operable to:analyze the tracking code suspect to determine, based on one or morecharacteristics of the tracking code suspect, whether the tracking codesuspect is tracking code; the reporting circuitry is operable to: aftera determination that the tracking code suspect is tracking code,generate a report that indicates the presence of tracking code in theemail message; and the message modification circuitry is operable toreplace the tracking code suspect in the email message with replacementcontent.
 2. The system of claim 1, wherein the one or morecharacteristics of the tracking code suspect comprise a transparencyattribute and/or size attribute of an image associated with the trackingcode suspect.
 3. The system of claim 1, wherein the one or morecharacteristics of the tracking code suspect comprise a uniform resourcelocator (URL) of the tracking code suspect.
 4. The system of claim 1,wherein the one or more characteristics of the tracking code suspectcomprise a particular domain or subdomain in a uniform resource locator(URL) of the tracking code suspect.
 5. The system of claim 1, whereinthe one or more characteristics of the tracking code suspect comprise aparticular query string in a uniform resource locator (URL) of thetracking code suspect.
 6. The system of claim 1, wherein the one or morecharacteristics of the tracking code suspect comprise a particular pathelement or combination of path elements in a uniform resource locator(URL) of the tracking code suspect.
 7. The system of claim 1, whereinthe one or more characteristics of the tracking code suspect comprise adomain or Internet Protocol (IP) address corresponding to a uniformresource locator (URL) of the tracking code suspect.
 8. The system ofclaim 1, wherein the one or more characteristics of the tracking codesuspect comprise a length, in number of alphanumeric characters, of thetracking code suspect.
 9. The system of claim 1, wherein the one or morecharacteristics of the tracking code suspect comprise characteristics ofvisible content of an image associated with the tracking code suspect.10. The system of claim 9, wherein the characteristics of visiblecontent of the image comprises color variation among pixels of theimage.
 11. The system of claim 1, wherein the one or morecharacteristics of the tracking code suspect comprise presence of aparticular substring in a uniform resource locator (URL) of the trackingcode suspect.
 12. The system of claim 1, wherein the one or morecharacteristics of the tracking code suspect comprise a uniform resourcelocator (URL) of the tracking code suspect matching a particular regularexpression.
 13. The system of claim 1, wherein the tracking code suspectcomprises a first uniform resource locator (URL).
 14. The system ofclaim 13, wherein the replacement content comprises a second URL. 15.The system of claim 14, wherein the second URL comprises the first URLas a query string.
 16. The system of claim 14, wherein the second URLcomprises the first URL as one or more path elements.
 17. The system ofclaim 14, comprising content cache interface circuitry operable to sendthe second URL to content caching circuitry.
 18. The system of claim 17,comprising the content caching circuitry and wherein the content cachingcircuitry is operable to fetch content from the first URL and store thecontent at a location pointed to by the second URL.
 19. The system ofclaim 1, wherein: the tracking code suspect analyzer circuitry isoperable to: determine which one of a plurality of categories to assignto identified tracking code based on a domain or IP address associatedwith the identified tracking code; and assign the one of the pluralityof categories to the identified tracking code.
 20. The system of claim1, wherein: the tracking code suspect analyzer circuitry is operable to:determine a risk level associated with the tracking code suspect basedon one or more of: a sender of the email message, a domain of the senderof the email message, one or more headers of the email message, and abody of the email message.